RE: RE: Take a bite out of my SPAM please

[mdillon]

no, you haven't missed anything. the entities , , and  all encode ASCII control characters. i don't think that this string can be turned into a navigable URL using only generic conversions. my guess is that the URL in the form is converted with JavaScript or something to allow to browser to use it as a FORM target.

i did a couple more conversions and got a bit more intelligible stuff out. here are the other conversions i ran:

$URL =~ s/&/&/g;

# numeric entities
$URL =~ s/&#(\d+);/pack('c', $1)/ge;

# hex escapes
$URL =~ s/%(\d{2})/pack('c', $1)/ge;

# 'decimal' IP
$URL =~ s/(\d{5,})/join('.', unpack('C4', pack('N', $1)))/ge;

the result was this (after running it through 'od -c'):

0000   h   t   t   p   :   /   /   w   w   w   .   d   n   s 020 002
0020 005 005 005 020 002 020 005 020 020 020 005 005 020 002 020 020
0040 002 020 020 002   m   a   g   i   c   s   i   t   e   .   n   e
0060   t   &   6   4   .   1   7   6   .   4   5   .   4   4   @   6
0100   4   .   1   7   6   .   4   5   .   4   3   &   6   3   .   9
0120   6   .   2   .   2   3   7   @   2   0   8   .   6   2   .   1
0140   4   .   2   4   8   ?   4   .   1   2   8   .   1   7   0   .
0160   1   2   2   &   p   r   o   x   y   =   6   3   .   9   6   .
0200   2   .   2   1   8   ?   6   4   .   1   7   6   .   4   5   .
0220   4   3   @   6   3   .   9   6   .   2   .   2   3   7   ?   w
0240   w   w   .   s   u   2   5   3   7   .   t   w   |   w   w   w
0260   . 020 002 005 005 005 020 020 020 005 005 020 002 020 020 002
0300 020 020 002   .   h   k   ?   /   p   r   o   x   y   =   6   3
0320   .   9   6   .   2   .   2   2   7   @   1   3   1   .   1   0
0340   3   .   2   2   9   .   3   7   :   2   0   3   0   @   1   3
0360   1   .   1   0   3   .   2   2   9   .   5   ?   /   @   6   4
0400   .   1   7   6   .   1   2   2   .   1   4   :   8   0   8   0
0420   @   6   4   .   1   7   6   .   1   1   3   .   8   8   @ 037
0440 036   &   #   ! 036   # 037   $   #  \n
0452

the main points of interest are the apparent IP addresses:

• 64.176.45.44
• 64.176.45.43
• 63.96.2.237
• 208.62.14.248
• 4.128.170.122
• 63.96.2.218
• 131.103.229.37:2030
• 131.103.229.5
• 64.176.122.14:8080
• 64.176.113.88

after checking a few of these out with reverse DNS and whois.arin.net, i've come to the conclusion that it's all just random garbage. i don't think that the alleged IP addresses are owned by affiliated entities, and none of them seem to be porn sites, so i think it's just someone mucking about.

[jreades]

I tried some slightly different approaches, but didn't come up with anything that looked much more usable:

Output 1 (using araqnid's sub):
http://www.dnsmagicsite.net&1085287724@1085287723 &1063256813@3493727992?75541114&proxy=1063256794? 1085287723@1063256813?www.su2537.tw|www..hk?/ proxy=1063256803@2204624165:2030@2204624133?/ @1085307406:8080@1085305176@%31%30%38%35%33%30%35%31%36%35

Output 2 (using a character map):
http://www.dns.hk?/proxy=1063256803@2204624165: 2030@2204624133?/@1085307406:8080 @1085305176@%31%30%38%35%33%30%35%31%36%35

I've included the character map below FWIW.

my %chars = (
        32 => '', 143 => '143',
        33 => '!', 144 => '144',
        34 => '"', 145 => '`',
        35 => '#', 146 => "'",
        36 => '$', 147 => '"',
        37 => '%', 148 => '"',
        38 => '&', 149 => '*',
        39 => "'", 150 => '-',
        40 => '(', 151 => '-',
        41 => ')', 152 => '~',
        42 => '*', 153 => '[tm]',
        43 => '+', 154 => 's',
        44 => ',', 155 => '>',
        45 => '-', 156 => 'oe',
        46 => '.', 157 => '',
        47 => '/', 158 => 'ž',
        48 => '0', 159 => 'Y',
        49 => '1', 160 => "'",
        50 => '2', 161 => '¡',
        51 => '3', 162 => '¢',
        52 => '4', 163 => '£',
        53 => '5', 164 => '¤',
        54 => '6', 165 => '¥',
        55 => '7', 166 => '¦',
        56 => '8', 167 => '§',
        57 => '9', 168 => '¨',
        58 => ':', 169 => '©',
        59 => ';', 170 => 'ª',
        60 => '<', 171 => '«',
        61 => '=', 172 => '¬',
        62 => '>', 173 => '­',
        63 => '?', 174 => '®',
        64 => '@', 175 => '¯',
        65 => 'A', 176 => '°',
        66 => 'B', 177 => '±',
        67 => 'C', 178 => '²',
        68 => 'D', 179 => '³',
        69 => 'E', 180 => '´',
        70 => 'F', 181 => 'µ',
        71 => 'G', 182 => '¶',
        72 => 'H', 183 => '·',
        73 => 'I', 184 => '¸',
        74 => 'J', 185 => '¹',
        75 => 'K', 186 => 'º',
        76 => 'L', 187 => '»',
        77 => 'M', 188 => '¼',
        78 => 'N', 189 => '½',
        79 => 'O', 190 => '¾',
        80 => 'P', 191 => '¿',
        81 => 'Q', 192 => 'À',
        82 => 'R', 193 => 'Á',
        83 => 'S', 194 => 'Â',
        84 => 'T', 195 => 'Ã',
        85 => 'U', 196 => 'Ä',
        86 => 'V', 197 => 'Å',
        87 => 'W', 198 => 'Æ',
        88 => 'X', 199 => 'Ç',
        89 => 'Y', 200 => 'È',
        90 => 'Z', 201 => 'É',
        91 => '[', 202 => 'Ê',
        92 => "\\", 203 => 'Ë',
        93 => ']', 204 => 'Ì',
        94 => '^', 205 => 'Í',
        95 => '_', 206 => 'Î',
        96 => '`', 207 => 'Ï',
        97 => 'a', 208 => 'Ð',
        98 => 'b', 209 => 'Ñ',
        99 => 'c', 210 => 'Ò',
       100 => 'd', 211 => 'Ó',
       101 => 'e', 212 => 'Ô',
       102 => 'f', 213 => 'Õ',
       103 => 'g', 214 => 'Ö',
       104 => 'h', 215 => '×',
       105 => 'i', 216 => 'Ø',
       106 => 'j', 217 => 'Ù',
       107 => 'k', 218 => 'Ú',
       108 => 'l', 219 => 'Û',
       109 => 'm', 220 => 'Ü',
       110 => 'n', 221 => 'Ý',
       111 => 'o', 222 => 'Þ',
       112 => 'p', 223 => 'ß',
       113 => 'q', 224 => 'à',
       114 => 'r', 225 => 'á',
       115 => 's', 226 => 'â',
       116 => 't', 227 => 'ã',
       117 => 'u', 228 => 'ä',
       118 => 'v', 229 => 'å',
       119 => 'w', 230 => 'æ',
       120 => 'x', 231 => 'ç',
       121 => 'y', 232 => 'è',
       122 => 'z', 233 => 'é',       123 => '{', 234 => 'ê',
       124 => '|', 235 => 'ë',
       125 => '}', 236 => 'ì',
       126 => '~', 237 => 'í',
       127 => '?', 238 => 'î',
       128 => '&#128;', 239 => 'ï',
       129 => '&#129;', 240 => 'ð',
       130 => ',', 241 => 'ñ',
       131 => 'f', 242 => 'ò',
       132 => ',,', 243 => 'ó',
       133 => '...', 244 => 'ô',
       134 => '?', 245 => 'õ',
       135 => '?', 246 => 'ö',
       136 => '^', 247 => '÷',
       137 => '?', 248 => 'ø',
       138 => 'S', 249 => 'ù',
       139 => '<', 250 => 'ú',
       140 => 'OE', 251 => 'û',
       141 => '&#141;', 252 => 'ü',
       142 => '&#142;', 253 => 'ý',
       143 => '&#143;', 254 => 'þ',
        'amp' => '&'
);

my $string = 'http://www.dns&#16;#2;&#5;&#5;&#5;&#16;&#2;&#16;&#5;&#16
+;&#16;&#16;&#5;&#5;&#16;&#2;&#16;&#16;&#2;&#16;&#16;&#2;magicsite.net
+&amp;1085287724@1085287723&amp;1063256813@3493727992?75541114&amp;pro
+xy=1063256794?1085287723@1063256813?www.su2537.tw|www.&#16;&#2;&#5;&#
+5;&#5;&#16;&#16;&#16;&#5;&#5;&#16;&#2;&#16;&#16;&#2;&#16;&#16;&#2;.hk
+?/proxy=1063256803@2204624165:2030@2204624133?/@1085307406:8080@10853
+05176@%31%30%38%35%33%30%35%31%36%35';

$string =~ s|\&(\S+)\;|$chars{$1}|g;

print $string . "\n";

exit 0;